Datenschutzerklärung

Stand · Last updated 27 August 2026

Verantwortlicher · Controller

The controller for the processing described on this page, within the meaning of Art. 4(7) GDPR, is:

Ve.Dev, Inhaber: Elvedin Odobasic

"Theodolindenstraße 18b 81545 München"

hello@ve-dev.agency

There is no statutory obligation to appoint a Datenschutzbeauftragter (data protection officer) for a business of this size, and none has been appointed. Write to the address above with anything to do with your data.

Besuch dieser Website · Visiting this site

The server that delivers these pages keeps ordinary access logs, as every web server does: the requested address, the time, the response, the referring page, the browser’s user agent and the requesting IP address. This is technically unavoidable in operating a website and is used to deliver the site and to investigate faults and abuse — nothing else. Logs are never combined with anything else on this page and are never used to build a profile of you.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is operating a working, secure website. Retention: these logs are held by the hosting provider (Vercel) and are kept for as long as that provider retains them — a matter of days — after which they are discarded. I do not copy them anywhere or keep my own archive of them.

Das Briefing-Formular · The design brief

The brief is the only form on this site, and it is the only place you are asked for personal data. Nothing is sent anywhere until you press submit on the final step.

Purpose: to understand what you need, to reply to you, and to prepare a quote and a proposal. Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract. For the rate limiting specifically, Art. 6(1)(f): the legitimate interest is keeping an open form from being abused by scripts.

Do you have to provide it? No, and there is no consequence beyond the obvious one: without a name and an email address there is no way to reply to you. Most of the questions are optional and can be skipped.

Retention: if we do not end up working together, I mark the submission archived and delete it — together with any files you attached — within 12 months. I do this by hand from my admin panel; there is no scheduled job doing it for me, and this page will not pretend otherwise. If we do work together, the submission is kept for as long as the project needs it and is then subject to the retention rules under Kundinnen und Kunden below. You can ask me to delete it sooner at any time.

Hochgeladene Dateien · Files you upload

If you attach a logo or brand material, the file is stored in a private bucket at Supabase. The bucket is not publicly readable and there is no address anyone can guess; I open files through short-lived signed links from my admin panel. Filenames are generated on the server, so the name your file had on your computer never becomes part of a web address. SVG files are refused outright, because an SVG is a document that can carry script.

Files are deleted with the submission they belong to, on the schedule above.

Automatisierte Verarbeitung durch einen KI-Dienst · Automated processing by an AI service

When you complete the design brief, your answers — and any logo or brand files you attached — are sent to Anthropic and processed by a large language model to produce a written brief: a starting point for the design and build, written for me to read. I start this when I review your submission, and may run it again if the brief needs rewriting. Each result is stored with your submission and read only by me. Your answers and files are not used to train any model.

Legal basis: Art. 6(1)(b) GDPR, as part of preparing a proposal at your request.

This is also stated plainly on the final step of the brief, before you submit anything. The answer to the question this section raises — whether a machine decides anything about you — is directly below.

Automatisierte Entscheidungsfindung · Automated decision-making

No decision about you is made by a machine. The language model described above produces notes. I read them, and every judgement about your project — whether I take the work, what it costs, what I recommend, whether I reply at all — is made by a person.

There is no automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR, and there is no profiling. Nothing on this site scores, ranks or categorises visitors, and nothing decides automatically who gets an answer.

Kontakt per E-Mail · Contacting me by email

If you write to me instead of using the form, your message and your email address are processed to answer you — and, in the nature of email, they sit in a mailbox afterwards. That mailbox is hosted by Hostinger, listed among the processors below. Legal basis: Art. 6(1)(b) GDPR where the message is about possible work, otherwise Art. 6(1)(f) — the legitimate interest in answering people who write to me. I keep correspondence for as long as the matter needs and delete it when it is closed, subject to the commercial retention duties below.

Kundinnen und Kunden · Clients and invoices

If we work together, I keep the details needed to invoice you: legal name, contact name, address, email and, where you have one, a VAT identification number. Legal basis: Art. 6(1)(b) GDPR to perform the contract, and Art. 6(1)(c) for the invoicing itself, which German law prescribes.

Retention: invoices and the client records behind them are kept for ten years. That is not a choice — § 147 AO and § 257 HGB require it, and a finalised invoice cannot be altered or deleted before then. A request for erasure cannot override this, though it does apply to everything not covered by it.

Empfänger · Who else receives data

Beyond the processors listed below, personal data reaches two kinds of recipient, and neither acts on my instructions — both are independently responsible for what they do with it.

That is the complete list. Nothing is sold, nothing is shared for advertising, and nothing is passed to anyone else unless a law requires it or you ask me to.

Speicherdauer · How long data is kept

Each section above states how long the data it describes is kept. Where no more specific period is given there, personal data stays with me only until the purpose it was collected for no longer applies — and is then deleted, unless a statutory duty requires me to keep it, as the ten-year rule on invoices does. If you ask me to delete something, or withdraw a consent, it goes at that point rather than at the end of the period.

None of this is automatic. There is no scheduled job deleting anything on this site; I do it by hand, which is a considered choice at this volume and is why no part of this page promises a purge that nothing would be running to perform.

Auftragsverarbeiter · Processors

Every third party that processes data on behalf of this site, what they do, and where they do it. Each is bound by a data processing agreement under Art. 28 GDPR and may use the data only to provide the service.

There are no others. Nothing on this site is served by a third party — no fonts, no scripts, no embedded videos, no maps. The fonts are downloaded at build time and served from this domain, so your browser makes no request to anyone but this site while you read it.

Übermittlung in Drittländer · Transfers outside the EU

The brief database and the file storage are hosted in the EU, in Ireland. The website itself is served from the EU. However, all four providers above are US companies or have US parent companies, and support and administrative access from the USA cannot be ruled out. The design brief is generated in the USA.

These transfers are covered by the safeguards Chapter V GDPR requires: the European Commission’s standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework — as set out in each provider’s data processing agreement. You can ask me for a copy of the safeguards that apply to any one of them.

Speicherung auf Ihrem Gerät · Storage on your device

This site sets no cookies. There is no tracking cookie, no advertising cookie, and no session cookie for visitors. (My own admin panel, behind a login and not reachable by anyone else, does set a session cookie — for me, not for you.)

One thing is stored on your device, and it is worth being exact about: while you fill in the design brief, your answers are saved in your browser’s local storage under the key ve.brief.v1, so that a refresh or a closed tab does not cost you twenty-four questions. It never leaves your browser until you press submit. This is storage strictly necessary to provide a service you explicitly requested, and is therefore exempt from the consent requirement under § 25(2) no. 2 TDDDG. You can clear it at any time by clearing site data in your browser — and files you attach are never saved there at all.

Analyse und Tracking · Analytics and tracking

There are none. This site runs no analytics product, no tracking pixel and no third-party script of any kind. That is why there is no consent banner — there is nothing to consent to.

Visitor IP addresses are used to rate-limit the brief form against automated abuse. They are hashed with a secret salt before they are stored, so the stored value cannot be turned back into an address, and the salt is never given to the database. Those records are discarded within a few hours; they exist to count requests in an hour, not to remember anyone.

Datensicherheit · Data security

Concretely, rather than as reassurance:

One honest limit: ordinary email is not encrypted end to end. If you write to me rather than using the form, that message travels the way all email does. Anything sensitive is better sent through the brief, or raised on a call.

Ihre Rechte · Your rights

You have the following rights over your personal data. Write to hello@ve-dev.agency and I will answer within one month, as Art. 12 requires. There is no charge, and you do not have to give a reason.

The right to object under Art. 21 is set out separately below, as the Regulation requires.

Where processing rests on consent, you may withdraw it at any time with effect for the future, without affecting anything done before you withdrew it.

Widerspruchsrecht · Your right to object

Beschwerderecht · Right to complain to a supervisory authority

If you think I am handling your data unlawfully, you can complain to a data protection supervisory authority — Art. 77 GDPR. You may do that in the EU member state where you live or work, or where you believe the problem occurred. The authority responsible for me is:

Bayerisches Landesamt für Datenaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany

You are welcome to raise it with me first, but you are not obliged to.

Änderungen · Changes to this notice

This page is updated whenever what the site does with data changes — in the same change that alters the site, not afterwards. The date at the top tells you when that last happened.